Support Claude Desktop-style interactive OIDC for MDM-managed third-party gateways in Claude Code

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Claude Desktop supports MDM-managed third-party gateway configurations with interactive OIDC authentication. It launches a browser-based sign-in flow, securely stores the resulting access and refresh tokens, and refreshes them when needed.

Claude Code does not currently support an equivalent authentication flow.

Claude Code’s forceLoginMethod: "gateway" and forceLoginGatewayUrl settings appear similar, but they expect the Claude Apps Gateway device-authorization contract and restrict organization-operated gateways to private IP addresses. They are therefore not equivalent to Claude Desktop’s third-party interactive authentication model.

Although ANTHROPIC_BASE_URL can route inference traffic through a custom endpoint, authentication must be provided separately through an API key, auth token, or apiKeyHelper. This prevents organizations from using centrally managed, short-lived OIDC authentication and requires additional credential-distribution or helper infrastructure.

Claude Code should support an MDM-managed interactive third-party gateway login method equivalent to the functionality already available in Claude Desktop.

Proposed Solution

Add an administrator-managed interactive OIDC login method for third-party gateways, equivalent to the functionality available in Claude Desktop.

Administrators should be able to configure this through MDM or managed settings, including:

• The trusted gateway URL.
• Interactive authentication as the credential type.
• Any required OIDC authorization metadata.
• The ability to enforce this login method on managed devices.

Claude Code should then launch the organization’s browser-based authentication flow, securely store access and refresh tokens in the operating system credential store, and refresh credentials automatically.

This could appear as a fourth “Organization LLM gateway” option in /login, or be selected automatically when enforced through MDM.

The existing Claude Apps Gateway device-authorization flow could remain a separate authentication mode. Public gateway URLs could remain restricted for user-supplied configuration while being permitted when installed through trusted MDM or managed settings.

Alternative Solutions

• Extend apiKeyHelper to support interactive login, secure token storage, and automatic refresh. This is workable, but requires every organization to build and maintain authentication functionality that Claude Desktop already provides.

• Expand the existing Claude Apps Gateway flow to support standard browser-based OIDC in addition to its current device-authorization contract.

• Allow administrators to configure a trusted executable that obtains short-lived credentials. Claude Code could invoke it when authentication is required and again when credentials expire.

• Continue distributing API keys or long-lived bearer tokens through MDM. This provides routing but lacks per-user authentication, straightforward revocation, and the security benefits of short-lived credentials.

• Require third-party gateways to implement the Claude Apps Gateway device-authorization protocol. This would add a second authentication implementation even when a working interactive OIDC integration already exists.

Priority

Medium - Would be very helpful

Feature Category

CLI commands and flags

Use Case Example

_No response_

Additional Context

_No response_